From 8b7eee070dab90ad4f73c0334bf9a277b63e4cd5 Mon Sep 17 00:00:00 2001 From: Fredrik Ekre Date: Fri, 24 Jul 2026 00:51:44 +0200 Subject: [PATCH] SSO: Backfill verified_at when associating an existing account When an existing non-SSO account is associated with an SSO login via `SSO_SIGNUPS_MATCH_EMAIL`, the user's `verified_at` is never set, even though the provider vouches for the address on every SSO login. Such users keep seeing the "verify your email" nudge unless they go through the manual email verification flow. Now `verified_at` is set on SSO login when the provider email matches the locally stored one, mirroring the existing behavior for new SSO users which get `verified_at` set on signup under the same conditions. Co-Authored-By: Claude Fable 5 --- src/api/identity.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/api/identity.rs b/src/api/identity.rs index 9212ed8d..a32fed21 100644 --- a/src/api/identity.rs +++ b/src/api/identity.rs @@ -336,6 +336,10 @@ async fn sso_login( user.name = user_name.clone(); } + user.save(conn).await?; + } else if user.verified_at.is_none() && user.email == user_infos.email { + // The email verification is handled by the provider, backfill for accounts created before SSO + user.verified_at = Some(now); user.save(conn).await?; }